|
 |
aab4b2 |
From 5e28d4aa823560545e6b49d58e55aecb572f6bd9 Mon Sep 17 00:00:00 2001
|
|
|
aab4b2 |
From: Watson Sato <wsato@redhat.com>
|
|
|
aab4b2 |
Date: Tue, 7 Feb 2023 10:53:18 +0100
|
|
|
aab4b2 |
Subject: [PATCH 4/5] Change custom zones check in firewalld_sshd_port_enabled
|
|
|
aab4b2 |
|
|
|
aab4b2 |
Patch-name: scap-security-guide-0.1.67-firewalld_sshd_port_enabled_tests-PR_10162.patch
|
|
|
aab4b2 |
Patch-status: Change custom zones check in firewalld_sshd_port_enabled
|
|
|
aab4b2 |
---
|
|
|
aab4b2 |
.../oval/shared.xml | 68 +++++++++++++++----
|
|
|
aab4b2 |
1 file changed, 54 insertions(+), 14 deletions(-)
|
|
|
aab4b2 |
|
|
|
aab4b2 |
diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml
|
|
|
aab4b2 |
index 4adef2e53f..d7c96665b4 100644
|
|
|
aab4b2 |
--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml
|
|
|
aab4b2 |
+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/oval/shared.xml
|
|
|
aab4b2 |
@@ -133,9 +133,10 @@
|
|
|
aab4b2 |
OVAL resources in order to detect and assess only active zone, which are zones with at
|
|
|
aab4b2 |
least one NIC assigned to it. Since it was possible to easily have the list of active
|
|
|
aab4b2 |
zones, it was cumbersome to use that list in other OVAL objects without introduce a high
|
|
|
aab4b2 |
- level of complexity to make sure environments with multiple NICs and multiple zones are
|
|
|
aab4b2 |
- in use. So, in favor of simplicity and readbility it was decided to work with a static
|
|
|
aab4b2 |
- list. It means that, in the future, it is possible this list needs to be updated. -->
|
|
|
aab4b2 |
+ level of complexity to ensure proper assessment in environments where multiple NICs and
|
|
|
aab4b2 |
+ multiple zones are in use. So, in favor of simplicity and readbility it was decided to
|
|
|
aab4b2 |
+ work with a static list. It means that, in the future, it is possible this list needs to
|
|
|
aab4b2 |
+ be updated. -->
|
|
|
aab4b2 |
|
|
|
aab4b2 |
datatype="string"
|
|
|
aab4b2 |
comment="Regex containing the list of zones files delivered in the firewalld package">
|
|
|
aab4b2 |
@@ -145,23 +146,62 @@
|
|
|
aab4b2 |
|
|
|
aab4b2 |
in the /etc/firewalld/zones dir in order to override the default zone settings. The same
|
|
|
aab4b2 |
directory is applicable for new zones created by the administrator. Therefore, all files
|
|
|
aab4b2 |
- in this directory should also allow SSH. -->
|
|
|
aab4b2 |
-
|
|
|
aab4b2 |
+ in this directory should also allow SSH.
|
|
|
aab4b2 |
+ This test was updated in a reaction to https://github.com/OpenSCAP/openscap/issues/1923,
|
|
|
aab4b2 |
+ which changed the behaviour of xmlfilecontent probe in OpenSCAP 1.3.7. Currently, a
|
|
|
aab4b2 |
+ variable test is the simplest way to check if all custom zones are allowing ssh, but have
|
|
|
aab4b2 |
+ an impact in transparency since the objects are not shown in reports. The transparency
|
|
|
aab4b2 |
+ impact can be workarounded by using other OVAL objects, but this would impact in
|
|
|
aab4b2 |
+ readability and would increase complexity. This solution is in favor of simplicity. -->
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
check="all" check_existence="at_least_one_exists" version="1"
|
|
|
aab4b2 |
comment="SSH service is defined in all zones created or modified by the administrator">
|
|
|
aab4b2 |
- <ind:object object_ref="object_firewalld_sshd_port_enabled_zone_files_etc"/>
|
|
|
aab4b2 |
- <ind:state state_ref="state_firewalld_sshd_port_enabled_zone_files_etc"/>
|
|
|
aab4b2 |
- </ind:xmlfilecontent_test>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ object_ref="object_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count"/>
|
|
|
aab4b2 |
+ <ind:state state_ref="state_firewalld_sshd_port_enabled_custom_zone_files_count"/>
|
|
|
aab4b2 |
+ </ind:variable_test>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ version="1">
|
|
|
aab4b2 |
+ <ind:var_ref>var_firewalld_sshd_port_enabled_custom_zone_files_with_ssh_count</ind:var_ref>
|
|
|
aab4b2 |
+ </ind:variable_object>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ datatype="int" version="1"
|
|
|
aab4b2 |
+ comment="Variable including number of custom zone files allowing ssh">
|
|
|
aab4b2 |
+ <count>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ object_ref="object_firewalld_sshd_port_enabled_zone_files_etc"/>
|
|
|
aab4b2 |
+ </count>
|
|
|
aab4b2 |
+ </local_variable>
|
|
|
aab4b2 |
|
|
|
aab4b2 |
<ind:xmlfilecontent_object id="object_firewalld_sshd_port_enabled_zone_files_etc" version="1">
|
|
|
aab4b2 |
- <ind:path>/etc/firewalld/zones</ind:path>
|
|
|
aab4b2 |
- <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
|
|
|
aab4b2 |
- <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
|
|
|
aab4b2 |
+ <ind:path>/etc/firewalld/zones</ind:path>
|
|
|
aab4b2 |
+ <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
|
|
|
aab4b2 |
+ <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
|
|
|
aab4b2 |
</ind:xmlfilecontent_object>
|
|
|
aab4b2 |
|
|
|
aab4b2 |
- <ind:xmlfilecontent_state id="state_firewalld_sshd_port_enabled_zone_files_etc" version="1">
|
|
|
aab4b2 |
- <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
|
|
|
aab4b2 |
- </ind:xmlfilecontent_state>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ version="1">
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ var_ref="var_firewalld_sshd_port_enabled_custom_zone_files_count"/>
|
|
|
aab4b2 |
+ </ind:variable_state>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ datatype="int" version="1"
|
|
|
aab4b2 |
+ comment="Variable including number of custom zone files present in /etc/firewalld/zones">
|
|
|
aab4b2 |
+ <count>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ object_ref="object_firewalld_sshd_port_enabled_custom_zone_files"/>
|
|
|
aab4b2 |
+ </count>
|
|
|
aab4b2 |
+ </local_variable>
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ <unix:file_object id="object_firewalld_sshd_port_enabled_custom_zone_files" version="1">
|
|
|
aab4b2 |
+
|
|
|
aab4b2 |
+ recurse_file_system="local"/>
|
|
|
aab4b2 |
+ <unix:path>/etc/firewalld/zones</unix:path>
|
|
|
aab4b2 |
+ <unix:filename operation="pattern match">^.*\.xml$</unix:filename>
|
|
|
aab4b2 |
+ </unix:file_object>
|
|
|
aab4b2 |
|
|
|
aab4b2 |
|
|
|
aab4b2 |
|
|
|
aab4b2 |
--
|
|
|
aab4b2 |
2.39.1
|
|
|
aab4b2 |
|